Microsoft discloses SSRF flaws in Purview, Entra ID, and Dynamics 365 Online

Microsoft published three high-severity cloud-service vulnerabilities affecting Microsoft Purview eDiscovery, Microsoft Entra ID Entitlement Management, and Microsoft Dynamics 365 Online. The flaws are tracked as CVE-2026-26150, CVE-2026-35431, and CVE-2026-32210, and all are classified as server-side request forgery (SSRF) under CWE-918. Microsoft tagged each issue as affecting an exclusively hosted service, indicating exposure in Microsoft-managed online environments rather than on-premises deployments.

According to the CVE records, CVE-2026-26150 could let an unauthorized attacker elevate privileges over a network in Purview eDiscovery, while CVE-2026-35431 and CVE-2026-32210 could enable spoofing in Entra ID Entitlement Management and Dynamics 365 Online. The published CVSS v3.1 vectors show low attack complexity and no required privileges across all three issues, with Entra ID carrying the broadest potential impact to confidentiality, integrity, and availability, and Dynamics 365 requiring user interaction. Microsoft linked the disclosures to its Security Response Center guidance for customer tracking and remediation.